HIPAA - Security Implementation Matrix for Business Continuity Planning and Disaster Recovery

The proposed rules for data security and electronic signature, published by the Department of Health and Human Services call for a contingency plan in the section on administrative procedures to guard data integrity, confidentiality, and availability.

The requirement states: “We would require a contingency plan to be in effect for responding to system emergencies. The organization would be required to perform periodic backups of data, have available critical facilities for continuing operations in the event of an emergency, and have disaster recovery procedures in place. To satisfy the requirement, the plan would include the following:

  • Applications and data criticality analysis

  • A data backup plan

  • A disaster recovery plan

  • An emergency mode operation plan

  • Testing and revision procedures"

The following section provides some guidelines in developing a business continuity plan and a disaster recovery plan.  The section maps to several requirements, which are noted.

 

Business Continuity Planning

Requirement

Implementation

Critical Business Function Analysis & Prioritization

 

 

 

1.        Mapping critical business functions to applications

 

Contingency Plan

·   Applications and data criticality

2.        Mapping applications to technologies (platforms, LANs/WANs, data storage, imaging, EDI, etc.)

 

Contingency Plan

·   Applications and data criticality

3.        Impact of business cycle on prioritization (end of month, quarter-end, year-end, etc.)

 

Contingency Plan

·   Applications and data criticality

4.        Strategy for regular update and review

 

Contingency Plan

·   Testing and revision

5.        Clear statement of risk assumption

Contingency Plan

 

Security Management Process

 

·   Applications and data criticality analysis

6.        Definition of minimum acceptable level of service and detailed actions to get to that level

 

Contingency Plan

·   Risk Analysis

·   Risk Management

·   Applications Analysis and data criticality

 

7.        Management participation and signoff on prioritization recommendations

Contingency Plan

·   Disaster Recovery Plan

·   Emergency Mode Operations Plan

·   Applications and data criticality 

Manual Procedures

 

 

 

1.        Local (desktop) transaction capture & tracking

Media Controls

·   Data Backup

·   Data Storage

·   Disposal

 

2.        Customer interface procedures

Contingency Plan

·   Emergency Mode Operations Plan

 

3.        Work-in-process (WIP)

Media Controls

·   Data Backup

·   Data Storage

·   Disposal

 

4.        Transaction flow

Media Controls

·   Data Backup

·   Data Storage

·   Disposal

 

5.        Supply Chain procedures

Chain of Trust Partner Agreement

 

 

6.        Forms Controls

·   Negotiable Documents Controls

·   Records Retentions

·   Forms Inventories

Security Management

Process

 

Contingency Plan

 

·   Risk Management

·   Disaster Recovery Plan

Work Around Procedures

 

 

 

1.        Hardcopy

2.        Reference Manuals

3.        Contact Information

4.        Procedures

5.        Paper Transactions

6.        Inventories

a) Transactions

b) Equipment

c) Forms

d) Personnel

e) Services

f)  Communications 

Contingency Plan

·   Disaster Recovery Plan &

·   Emergency Mode Operations Plan

 

Business Unit Contingency Teams Organization

 

 

 

1.        Emergency Management/Crisis Management guidelines/procedures/decisions

Contingency Plan

·   Emergency Mode Operations Plan

 

2.        Public relations/Media Interaction guidelines

Contingency Plan

·   Emergency Mode Operations Plan

 

3.        Emergency notification process and responsibilities

Contingency Plan

·   Disaster Recovery Plan &

·   Emergency Mode Operations Plan

 

4.        Hardcopy, local backup strategies

Contingency Plan

·   Disaster Recovery Plan

 

5.        Key vendor information

Contingency Plan

·   Disaster Recovery Plan

 

6.        Recovery Logistics

Contingency Plan

·   Disaster Recovery Plan

 

7.        Human Elements

Contingency Plan

·   Disaster Recovery Plan

 

8.        Teams Composition

a) Skill set match

b) Training

c) Testing

 

Contingency Plan

·   Disaster Recovery Plan

9.        Specific procedures for activating and de-activating contingency operations

a) Authorization to activate/de-activate

b) Quantified service level thresholds for activation/de-activation

c) Triggers to activate/de-activate

d) Methods for quantifying degradation of service

e) Responsibilities/Authorities/Accountabilities during contingency operations

Contingency Plan

·   Disaster Recovery Plan &

·   Emergency Mode Operations Plan

10.     Voice Communications

a) As part of business functions

b) As part of BCP

Contingency Plan

·   Disaster Recovery Plan &

·   Emergency Mode Operations Plan

 

11.     Business Continuity Plan Controls

a) Plan Distribution

b) Plan Maintenance

c) Plan Testing

d) Responsibilities

e) Authorities

 

Contingency Plan

·   Disaster Recovery Plan &

·   Emergency Mode Operations Plan

Crisis Management Teams & Procedures

 

 

 

1.        Crisis Management Teams

a) Technical

b) Functional

 

Contingency Plan

·   Emergency Mode Operations Plan

2.        Crisis Management Procedures

a) Public Relations

b) Notifications

c) Escalations

 

Contingency Plan

·   Emergency Mode Operations Plan

 

 

Disaster Recovery Planning

Requirement

Implementation

Critical Applications Analysis & Prioritization

 

 

1.        Strategy for prioritization

Contingency Plan

·   Applications and Data Criticality Analysis

 

2.        Strategy for regular review & update

Contingency Plan

·   Applications and Data Criticality Analysis

·   Testing and Revision

 

3.        Change in prioritization based on shift in business cycle

Contingency Plan

·   Applications and Data Criticality Analysis

·   Testing and Revision

 

4.        Management review/signoff on prioritizations

Contingency Plan

·   Applications and Data Criticality Analysis

·   Testing and Revision

 

5.        Application dependencies/interdependencies

Contingency Plan

·   Applications and Data Criticality Analysis

 

6.        Mapping critical applications to business functions

Contingency Plan

·   Applications and Data Criticality Analysis

 

7.        Application downtime procedures

Contingency Plan

·   Applications and Data Criticality Analysis

·   Disaster Recovery Plan

 

8.        Time thresholds for invoking downtime procedures

Contingency Plan

·   Applications and Data Criticality Analysis

·   Disaster Recovery Plan

 

Data Backup Procedures

 

 

 

1.        File Naming Conventions

2.        Records Retention Program

3.        Offsite Storage

a) Technology Employed

b) Physical view of offsite

c) Logical view of offsite

d) Rotation Procedures

 

Contingency Plan & Media Controls

·   Data Backup

·   Data Storage

·   Disposal

·   Disaster Recovery Plan

Offsite Storage Capabilities

 

 

 

1.        Standard Physical Rotations

2.        Electronic Shadowing

3.        Electronic Journaling

4.        Data Mirroring

5.        Facility Security

6.        Transport Security

Contingency Plan & Media Controls

 

·   Data Backup

·   Data Storage

·   Disposal

·   Disaster Recovery Plan

 

7.        Disaster Recovery Plan Controls

a) Plan Distribution

b) Plan Maintenance

c) Plan Testing

d) Responsibilities

e) Authorities

 

Contingency Plan

·   Disaster Recovery Plan

 

Restoration Teams and Documentation

 

 

 

1.        Hardware Restoration/Replacement Procedures

a) Service Requests

b) Purchase Orders

c) Supply Chain

2.        Return Home Procedures

a) Hardware certification

b) Parallel processing

c) Cutover

d) Alternate Site Shutdown

e) Data Disposition

1.  Delete/Scratch Controls

2.  DASD Overwrite Procedures

3.  Physical Data Handling To/From Sites